feat: worktree ownership safety — prevent cross-session removal (t189)

.agents/AGENTS.md

@@ -166,7 +166,7 @@ worktree-helper.sh add feature/x  # Fallback
 
 **Branch types**: `feature/`, `bugfix/`, `hotfix/`, `refactor/`, `chore/`, `experiment/`, `release/`
 
-**Worktree ownership** (CRITICAL): NEVER remove a worktree unless (a) you created it in this session, (b) it belongs to a task in your active batch, AND the task is deployed/complete, or (c) the user explicitly asks. Worktrees may belong to parallel sessions — removing them destroys another agent's working directory mid-work. When cleaning up, only touch worktrees for tasks you personally merged. Use `git worktree list` to see all worktrees but do NOT assume unrecognized ones are safe to remove.
+**Worktree ownership** (CRITICAL): NEVER remove a worktree unless (a) you created it in this session, (b) it belongs to a task in your active batch, AND the task is deployed/complete, or (c) the user explicitly asks. Worktrees may belong to parallel sessions — removing them destroys another agent's working directory mid-work. When cleaning up, only touch worktrees for tasks you personally merged. Use `git worktree list` to see all worktrees but do NOT assume unrecognized ones are safe to remove. The ownership registry (`worktree-helper.sh registry list`) tracks which PID owns each worktree — `remove` and `clean` commands automatically refuse to touch worktrees owned by other live processes.
 
 **Safety hooks** (Claude Code only): Destructive commands (`git reset --hard`, `rm -rf`, etc.) are blocked by a PreToolUse hook. Run `install-hooks.sh --test` to verify. See `workflows/git-workflow.md` "Destructive Command Safety Hooks" section.
 

.agents/scripts/shared-constants.sh

@@ -504,6 +504,176 @@ _todo_commit_push_inner() {
     return 1
 }
 
+# =============================================================================
+# Worktree Ownership Registry (t189)
+# =============================================================================
+# SQLite-backed registry that tracks which session/batch owns each worktree.
+# Prevents cross-session worktree removal — the root cause of t189.
+#
+# Available to all scripts that source shared-constants.sh.
+
+WORKTREE_REGISTRY_DIR="${HOME}/.aidevops/.agent-workspace"
+WORKTREE_REGISTRY_DB="${WORKTREE_REGISTRY_DIR}/worktree-registry.db"
+
+# SQL-escape a value for SQLite (double single quotes)
+_wt_sql_escape() {
+    local val="$1"
+    echo "${val//\'/\'\'}"
+}
+
+# Initialize the registry database
+_init_registry_db() {
+    mkdir -p "$WORKTREE_REGISTRY_DIR" 2>/dev/null || true
+    sqlite3 "$WORKTREE_REGISTRY_DB" "
+        CREATE TABLE IF NOT EXISTS worktree_owners (
+            worktree_path TEXT PRIMARY KEY,
+            branch        TEXT,
+            owner_pid     INTEGER,
+            owner_session TEXT DEFAULT '',
+            owner_batch   TEXT DEFAULT '',
+            task_id       TEXT DEFAULT '',
+            created_at    TEXT DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+        );
+    " 2>/dev/null || true
+    return 0
+}
+
+# Register ownership of a worktree
+# Arguments:
+#   $1 - worktree path (required)
+#   $2 - branch name (required)
+#   Flags: --task <id>, --batch <id>, --session <id>
+register_worktree() {
+    local wt_path="$1"
+    local branch="$2"
+    shift 2
+
+    local task_id="" batch_id="" session_id=""
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --task) task_id="${2:-}"; shift 2 ;;
+            --batch) batch_id="${2:-}"; shift 2 ;;
+            --session) session_id="${2:-}"; shift 2 ;;
+            *) shift ;;
+        esac
+    done
+
+    _init_registry_db
+
+    sqlite3 "$WORKTREE_REGISTRY_DB" "
+        INSERT OR REPLACE INTO worktree_owners
+            (worktree_path, branch, owner_pid, owner_session, owner_batch, task_id)
+        VALUES
+            ('$(_wt_sql_escape "$wt_path")',
+             '$(_wt_sql_escape "$branch")',
+             $$,
+             '$(_wt_sql_escape "$session_id")',
+             '$(_wt_sql_escape "$batch_id")',
+             '$(_wt_sql_escape "$task_id")');
+    " 2>/dev/null || true
+    return 0
+}
+
+# Unregister ownership of a worktree
+# Arguments:
+#   $1 - worktree path (required)
+unregister_worktree() {
+    local wt_path="$1"
+
+    [[ ! -f "$WORKTREE_REGISTRY_DB" ]] && return 0
+
+    sqlite3 "$WORKTREE_REGISTRY_DB" "
+        DELETE FROM worktree_owners
+        WHERE worktree_path = '$(_wt_sql_escape "$wt_path")';
+    " 2>/dev/null || true
+    return 0
+}
+
+# Check who owns a worktree
+# Arguments:
+#   $1 - worktree path
+# Output: owner info (pid|session|batch|task|created_at) or empty
+# Returns: 0 if owned, 1 if not owned
+check_worktree_owner() {
+    local wt_path="$1"
+
+    [[ ! -f "$WORKTREE_REGISTRY_DB" ]] && return 1
+
+    local owner_info
+    owner_info=$(sqlite3 -separator '|' "$WORKTREE_REGISTRY_DB" "
+        SELECT owner_pid, owner_session, owner_batch, task_id, created_at
+        FROM worktree_owners
+        WHERE worktree_path = '$(_wt_sql_escape "$wt_path")';
+    " 2>/dev/null || echo "")
+
+    if [[ -n "$owner_info" ]]; then
+        echo "$owner_info"
+        return 0
+    fi
+    return 1
+}
+
+# Check if a worktree is owned by a DIFFERENT process (still alive)
+# Arguments:
+#   $1 - worktree path
+# Returns: 0 if owned by another live process, 1 if safe to remove
+is_worktree_owned_by_others() {
+    local wt_path="$1"
+
+    [[ ! -f "$WORKTREE_REGISTRY_DB" ]] && return 1
+
+    local owner_pid
+    owner_pid=$(sqlite3 "$WORKTREE_REGISTRY_DB" "
+        SELECT owner_pid FROM worktree_owners
+        WHERE worktree_path = '$(_wt_sql_escape "$wt_path")';
+    " 2>/dev/null || echo "")
+
+    # No owner registered
+    [[ -z "$owner_pid" ]] && return 1
+
+    # We own it
+    [[ "$owner_pid" == "$$" ]] && return 1
+
+    # Owner process is dead — stale entry, safe to remove
+    if ! kill -0 "$owner_pid" 2>/dev/null; then
+        # Clean up stale entry
+        unregister_worktree "$wt_path"
+        return 1
+    fi
+
+    # Owner process is alive and it's not us — NOT safe to remove
+    return 0
+}
+
+# Prune stale registry entries (dead PIDs, missing directories)
+prune_worktree_registry() {
+    [[ ! -f "$WORKTREE_REGISTRY_DB" ]] && return 0
+
+    local entries
+    entries=$(sqlite3 -separator '|' "$WORKTREE_REGISTRY_DB" "
+        SELECT worktree_path, owner_pid FROM worktree_owners;
+    " 2>/dev/null || echo "")
+
+    [[ -z "$entries" ]] && return 0
+
+    while IFS='|' read -r wt_path owner_pid; do
+        local should_prune=false
+
+        # Directory no longer exists
+        if [[ ! -d "$wt_path" ]]; then
+            should_prune=true
+        # Owner process is dead
+        elif [[ -n "$owner_pid" ]] && ! kill -0 "$owner_pid" 2>/dev/null; then
+            should_prune=true
+        fi
+
+        if [[ "$should_prune" == "true" ]]; then
+            unregister_worktree "$wt_path"
+        fi
+    done <<< "$entries"
+    return 0
+}
+
 # =============================================================================
 # Export all constants for use in other scripts
 # =============================================================================

.agents/scripts/supervisor-helper.sh

@@ -2798,10 +2798,21 @@ create_task_worktree() {
     fi
 
     if [[ "$needs_cleanup" == "true" ]]; then
+        # Ownership check (t189): refuse to clean worktrees owned by other sessions
+        if [[ -d "$worktree_path" ]] && is_worktree_owned_by_others "$worktree_path"; then
+            local stale_owner_info
+            stale_owner_info=$(check_worktree_owner "$worktree_path" || echo "unknown")
+            log_warn "Cannot clean stale worktree $worktree_path — owned by another active session (owner: $stale_owner_info)" >&2
+            # Return existing path — let the caller decide
+            echo "$worktree_path"
+            return 0
+        fi
         # Remove worktree if it exists
         if [[ -d "$worktree_path" ]]; then
             git -C "$repo" worktree remove "$worktree_path" --force &>/dev/null || rm -rf "$worktree_path"
             git -C "$repo" worktree prune &>/dev/null || true
+            # Unregister ownership (t189)
+            unregister_worktree "$worktree_path"
         fi
         # Delete local branch — MUST suppress stdout (outputs "Deleted branch ...")
         # which would pollute the function's return value captured by $()
@@ -2813,19 +2824,25 @@ create_task_worktree() {
     # Try wt first (redirect its verbose output to stderr)
     if command -v wt &>/dev/null; then
         if wt switch -c "$branch_name" -C "$repo" >&2 2>&1; then
+            # Register ownership (t189)
+            register_worktree "$worktree_path" "$branch_name" --task "$task_id"
             echo "$worktree_path"
             return 0
         fi
     fi
 
     # Fallback: raw git worktree add (quiet, reliable)
     if git -C "$repo" worktree add "$worktree_path" -b "$branch_name" >&2 2>&1; then
+        # Register ownership (t189)
+        register_worktree "$worktree_path" "$branch_name" --task "$task_id"
         echo "$worktree_path"
         return 0
     fi
 
     # Branch may already exist without worktree (e.g. remote-only)
     if git -C "$repo" worktree add "$worktree_path" "$branch_name" >&2 2>&1; then
+        # Register ownership (t189)
+        register_worktree "$worktree_path" "$branch_name" --task "$task_id"
         echo "$worktree_path"
         return 0
     fi
@@ -2836,22 +2853,38 @@ create_task_worktree() {
 
 #######################################
 # Clean up a worktree for a completed/failed task
+# Checks ownership registry (t189) before removal
 #######################################
 cleanup_task_worktree() {
     local worktree_path="$1"
     local repo="$2"
 
     if [[ ! -d "$worktree_path" ]]; then
+        # Directory gone — clean up registry entry if any
+        unregister_worktree "$worktree_path"
+        return 0
+    fi
+
+    # Ownership check (t189): refuse to remove worktrees owned by other sessions
+    if is_worktree_owned_by_others "$worktree_path"; then
+        local owner_info
+        owner_info=$(check_worktree_owner "$worktree_path" || echo "unknown")
+        log_warn "Skipping cleanup of $worktree_path — owned by another active session (owner: $owner_info)"
         return 0
     fi
 
     # Try wt prune first
     if command -v wt &>/dev/null; then
-        wt remove -C "$repo" "$worktree_path" 2>>"$SUPERVISOR_LOG" && return 0
+        if wt remove -C "$repo" "$worktree_path" 2>>"$SUPERVISOR_LOG"; then
+            unregister_worktree "$worktree_path"
+            return 0
+        fi
     fi
 
     # Fallback: git worktree remove
     git -C "$repo" worktree remove "$worktree_path" --force 2>>"$SUPERVISOR_LOG" || true
+    # Unregister regardless of removal success (directory may be partially cleaned)
+    unregister_worktree "$worktree_path"
     return 0
 }
 
@@ -6019,7 +6052,9 @@ cmd_cleanup() {
         done
     fi
 
+    # Prune stale registry entries (t189)
     if [[ "$dry_run" == "false" ]]; then
+        prune_worktree_registry
         log_success "Cleaned up $cleaned worktrees, $process_cleaned worker processes"
     fi